TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Is BIND9 suitable as a recursive resolver in 2025?

22 点作者 plagiat0r大约 1 个月前

5 条评论

sybercecurity大约 1 个月前
BIND9 used to also be the basis for a lot of DNS appliances back in the day, so unless you are running your own recursive server, you might still be running bind, just with a GUI front end.
johnklos大约 1 个月前
&quot;Should you ever operate your recursive resolver on only one network? Specifically, should it be limited to the IPv4 or IPv6 network? The general answer for the year 2025 is: NO, you shouldn&#x27;t.&quot;<p>I wholeheartedly disagree. When given the choice between our ISP&#x27;s DNS, DNS served by a for-profit company that wants to be a monopoly (such as Cloudflare or Google), or running your own DNSSEC enabled, fully recursive DNS server, you should absolutely run your own, if you&#x27;re even slightly technical.<p>If your network is only IPv6, then you already have plenty of issues with general Internet use and should know your caveats. If you&#x27;re using only IPv4, then you know to run BIND with &quot;-4&quot;.<p>Either way, if you only have one or the other, then you have much more control over what happens when you run your own recursive resolver, regardless of whether it&#x27;s BIND, Unbound or something else.<p>The author may&#x27;ve made some money being slightly passive aggressive about running BIND and pretending to not know about &quot;-4&quot;, but that&#x27;s more a self own than a slight on BIND, in my opinion.
评论 #43552750 未加载
plagiat0r大约 1 个月前
This article summarize my findings on what I believe to be a buggy recursive algorithm. Main actors: BIND-9.18, BIND-9.20 and wireshark.
jmholla大约 1 个月前
I felt this article didn&#x27;t do a good job of diving into the whys of what was going on. It makes statements without qualification and then blames bind for them. It draws conclusions, then the subsequent sections don&#x27;t really seem to follow from those conclusions. It also drops pieces of information that end up not having a role in the article at large and that is jarring. (For instance, while the link to Geoff Huston&#x27;s article is neat, they almost immediately say that nothing in the article was useful to the issue at hand. This would&#x27;ve been better provided as an errata or some other footer style note.)<p>I know the author found some issues with defaults in bind and definitely some logging bugs, but not everything levied at bind was really its fault. And I didn&#x27;t feel the tone was fair much of the time.<p>---<p>&gt; If you forget to set `forward only;` and relies on the default value, which is `forward first;`, you will fail to meet the requirement of forwarding all queries to the designated forwarders. In such a scenario, BIND9 may intermittently act as a fully recursive resolver for certain queries, and if the firewall is not configured to permit UDP&#x2F;53 and TCP&#x2F;53 traffic to the entire internet, then you are out of luck.<p>I wish the author had expanded a bit more on this. I guess we take it for granted that their previous firewall configuration had allowed outbound UDP connections on port 53 to the targeted upstreams. And that they tried one or the other instead of both simultaneously. I would&#x27;ve like to seem them use tcpdump to analyze why TCP is necessary.<p>I&#x27;m assuming the wide UDP purview is because the target nameservers they query return other DNS servers which bind then recursively queries. So, this requirement doesn&#x27;t surprise me at all as it does need to talk to more that just the specified IPs. Even the product they recommend, Unbound, would have to be doing something like this. Perhaps maintaining an ongoing allowlist automatically?<p>I didn&#x27;t like starting off the article with a complaint against bind9 that&#x27;s really not its fault.<p>Later,<p>&gt; Fortunately, we&#x27;re witnessing some progress in this regard, with the elimination of annoying lame-servers warnings for the IPv6 network address space, so let&#x27;s test it again:<p>Annoying, I feel, is not a good word to use here. The stack doesn&#x27;t really support IPv6 but it definitely looks like it does. So of course it&#x27;s going to complain that it can&#x27;t reach servers you asked it to. This is an example of where I found the tone of the article to be unfair.<p>&gt; The question is simple: Should you ever operate your recursive resolver on only one network? Specifically, should it be limited to the IPv4 or IPv6 network?<p>&gt; The general answer for the year 2025 is: NO, you shouldn&#x27;t.<p>But up to this point, that&#x27;s what the author has been doing. They&#x27;ve setup bind to run on IPv4 and IPv6 but not really the latter, instead blackholing all such requests.<p>---<p>As the author discovers, their issue revolved around the fact that blackholing counts against request limits and hence the discrepancy between requests and configured limits. I do feel blackholing counting against those metrics is up for discussion, but I can see why some people would expect and want them to count. Perhaps it too needs a configuration flag.<p>As for the request for separate counters, I think they need separate configuration options with distinct names and not blanket configure both counters identically. I wouldn&#x27;t expect up to double the requests I specify to be made. But I otherwise think this is a fantastic idea.<p>bind is a very barebones DNS resolver. It doesn&#x27;t have the bells and whistles other resolvers have. It&#x27;s the core technology that more featureful resolvers can build upon. And there&#x27;s room for improvement and I hope the author&#x27;s requests get traction.
评论 #43543394 未加载
cvalka大约 1 个月前
No